Job scam quick guide: it's a scam if...

they want you to collect and forward money in any way (a "money mule" job). You'll wind up engaged in money laundering, personally defrauded via expertly forged cheques, money orders, etc, or defrauding someone else who pays for goods that never arrive.

they want you to receive packages and reship them somewhere else. The goods will have been obtained fraudulently, and they're just using you to make the shipping address appear local. You will be aiding fraud.

they want up-front payment (either to them or someone else) of any sort for anything before you can get the job. This is advance fee fraud: there is no job -- it's just a big con to extract money from you.

they want you to buy any kind of "membership" or "kit" in order to start. Forget it -- it's not a real job at all: they're trying to sell you something, and they're probably making a bunch of other false claims about it if they're pitching it as a "job".

it's a job offer, and it's spam. There are LOTS of these scams about, as you can see.

Friday, June 21, 2013

Hi, everyone. It's been years since I've posted anything new here, because there's been nothing new and interesting to report -- just more of the same old same old. Today, however, I happened across something I haven't seen before. In one sense, it's just another run-of-the-mill job scam, but this time we get a special behind-the-scenes peek at how job scammer spam works, and I think that's worth sharing.

So, while doing a little research for someone who sent in an inquiry about a job offer from "Quick Auction Group", my Google search struck gold. This particular spammer is using a compromised third-party website as his spamming platform -- a popular choice these days -- but this one is indexed by Google, which usually doesn't happen. As a result, I found the template file that is being used to generate this particular spam.

When you're a spammer, one of the problems that you face is that it's easy to detect spam when you send out millions of copies of exactly the same message. Spammers don't want to be easy to detect, so they need to make each message as different as possible, while still being similar enough that it makes no difference to the people who receive it. One way they do this is by the use of randomised templates.

A randomised template is a file that contains all the information which is to go into the email, but parts of it are alternative phrases enclosed in brackets and separated by vertical bars. When the email-generator encounters these constructs, it picks one phrase at random from the group. Thus, if the template contains the text, "See you next (Monday|Tuesday|Wednesday|Thursday|Friday), spammer!", the email-generator might produce the phrase, "See you next Tuesday, spammer!" as its output -- or it might choose some other day of the week.

Given enough alternative phrases of this sort, each email can be more-or-less unique, while being more-or-less the same as every other email in all the important details. This technique also makes it much harder to search for key phrases in the email, since there's no guarantee that any particular phrase is fixed rather than random. Or it would make it much harder to search for key phrases if it weren't for the fact that these hapless crooks left their whole template in a location which is indexed by Google.

In any case, without further ado, here is what a job scammer template looks like, given the particular template system that this one uses. Note that they've put a lot of effort into making the email "subject" header variable. Nearly half the template is dedicated to variations on that one part!

About This Blog

This blog is an offshoot of iDeceive, which documents deceptive Internet activity. For more general information, please go to that blog. All entries posted here are employment scams. If you've received an email that resembles anything posted here, you'd be well advised to assume that the sender wants to exploit you, not employ you.
Scammers often impersonate real companies. Where real company names are mentioned here, you should assume that a scammer is using that identity fraudulently unless you have strong evidence to the contrary.

Need advice?

If you need advice about a possible scam, and you don't want to post a comment on the blog, contact Deception Spotter via email at ideceive@gmail.com.Please include the word "Spotter" in the subject: the message will then be flagged for my attention, and won't be classified as spam. Most relevant correspondence is answered within 24 hours, but no guarantee is offered as this is an unpaid, voluntary public service.

What is a money mule?

The vast majority of job scams seek to recruit money mules, usually under titles like "financial manager", "payment processor", "transaction specialist", or just plain "representative" or even "partner". The job of a money mule is to be a financial middle-man, accepting payment in one form, and forwarding it (minus a fee) to another party, usually via Western Union. Scammers employ money mules to launder money on their behalf: the mule is responsible for converting a fraudulent transaction of some kind into quick, anonymous cash, usually transferred via Western Union or some similar scheme. Scammers send out a lot of job ads for money mule positions and never refuse an applicant because they are disposable: money mules either get ripped off directly (as when they are persuaded to bank a forged cheque or money order which is later dishonoured by the bank), or take the blame for defrauding someone else (as with most payments involving direct bank transfer, PayPal, or similar). Don't make an ass of yourself: don't be a money mule.